Skip to content

K
Kernel

openeuler / Kernel
1 年多 前同步成功

通知 8
Star 0
Fork 0
K
Kernel
切换分支/标签
  1. 09 11月, 2017 2 次提交
    • M
      ima: always measure and audit files in policy · f3cc6b25
      由 Mimi Zohar 提交于 
      All files matching a "measure" rule must be included in the IMA
measurement list, even when the file hash cannot be calculated.
Similarly, all files matching an "audit" rule must be audited, even when
the file hash can not be calculated.

The file data hash field contained in the IMA measurement list template
data will contain 0's instead of the actual file hash digest.

Note:
In general, adding, deleting or in anyway changing which files are
included in the IMA measurement list is not a good idea, as it might
result in not being able to unseal trusted keys sealed to a specific
TPM PCR value.  This patch not only adds file measurements that were
not previously measured, but specifies that the file hash value for
these files will be 0's.

As the IMA measurement list ordering is not consistent from one boot
to the next, it is unlikely that anyone is sealing keys based on the
IMA measurement list.  Remote attestation servers should be able to
process these new measurement records, but might complain about
these unknown records.
Signed-off-by: NMimi Zohar <zohar@linux.vnet.ibm.com>
Reviewed-by: NDmitry Kasatkin <dmitry.kasatkin@huawei.com>
      f3cc6b25
    • M
      ima: don't remove the securityfs policy file · 2068626d
      由 Mimi Zohar 提交于 
      The securityfs policy file is removed unless additional rules can be
appended to the IMA policy (CONFIG_IMA_WRITE_POLICY), regardless as
to whether the policy is configured so that it can be displayed.

This patch changes this behavior, removing the securityfs policy file,
only if CONFIG_IMA_READ_POLICY is also not enabled.
Signed-off-by: NMimi Zohar <zohar@linux.vnet.ibm.com>
      2068626d
  3. 30 6月, 2017 1 次提交
  5. 22 6月, 2017 15 次提交
  7. 05 6月, 2017 3 次提交
  9. 05 4月, 2017 1 次提交
    • M
      KEYS: Use structure to capture key restriction function and data · 2b6aa412
      由 Mat Martineau 提交于 
      Replace struct key's restrict_link function pointer with a pointer to
the new struct key_restriction. The structure contains pointers to the
restriction function as well as relevant data for evaluating the
restriction.

The garbage collector checks restrict_link->keytype when key types are
unregistered. Restrictions involving a removed key type are converted
to use restrict_link_reject so that restrictions cannot be removed by
unregistering key types.
Signed-off-by: NMat Martineau <mathew.j.martineau@linux.intel.com>
      2b6aa412
  11. 13 3月, 2017 1 次提交
    • M
      ima: provide ">" and "<" operators for fowner/uid/euid rules. · 3dd0c8d0
      由 Mikhail Kurinnoi 提交于 
      For now we have only "=" operator for fowner/uid/euid rules. This
patch provide two more operators - ">" and "<" in order to make
fowner/uid/euid rules more flexible.

Examples of usage.

 Appraise all files owned by special and system users (SYS_UID_MAX 999):
    appraise fowner<1000
 Don't appraise files owned by normal users (UID_MIN 1000):
    dont_appraise fowner>999
 Appraise all files owned by users with UID 1000-1010:
    dont_appraise fowner>1010
    appraise fowner>999

Changelog v3:
- Removed code duplication in ima_parse_rule().
- Fix ima_policy_show() - (Mimi)

Changelog v2:
- Fixed default policy rules.
Signed-off-by: NMikhail Kurinnoi <viewizard@viewizard.com>
Signed-off-by: NMimi Zohar <zohar@linux.vnet.ibm.com>

 security/integrity/ima/ima_policy.c | 115 +++++++++++++++++++++++++++---------
 1 file changed, 87 insertions(+), 28 deletions(-)
      3dd0c8d0
  13. 07 3月, 2017 2 次提交
  15. 28 1月, 2017 2 次提交
  17. 21 12月, 2016 8 次提交
  19. 14 11月, 2016 4 次提交
  21. 08 10月, 2016 1 次提交